power-grid-cascade

Overview ¶

Package main models a regional power grid attack scenario inspired by the 2015/2016 Ukraine power grid attacks (BlackEnergy/Industroyer). The Sandworm threat actor (GRU Unit 74455) used spear-phishing to gain access to corporate IT networks, pivoted through VPN and SCADA systems, and simultaneously opened breakers at multiple distribution substations — causing a cascading blackout affecting 230,000 customers.

This example demonstrates how graph analysis (shortest paths, connected components, betweenness centrality, blast radius) exposes the structural vulnerabilities that made such an attack possible.

Part of the book "Protecting Critical Infrastructure" by Darragh Downey.